Overview

overview

10

Static

static

10

Builder Wo...ro.exe

windows10-2004-x64

10

Builder Wo...ip.dll

windows10-2004-x64

1

Builder Wo...et.dll

windows10-2004-x64

1

Builder Wo...gn.dll

windows10-2004-x64

1

Builder Wo...ts.dll

windows10-2004-x64

1

Builder Wo...rk.dll

windows10-2004-x64

1

Builder Wo...il.dll

windows10-2004-x64

1

Builder Wo...ub.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Builder WorldWind Pro.zip

  • Size

    991KB

  • MD5

    4a952a54799b2e4d3a865f62cb3dee83

  • SHA1

    0d00173fa4e28968f5fbb5db646e1d6d98e6fa5b

  • SHA256

    28553084a22a3336caf73b0c576843f93472e76a6586601def820db18dc025c0

  • SHA512

    0f7f5204d7a6a9599fad0114a81e3681096e5af868339a54d80269cde0b274576c8b78b47b36cb9b5e826f62bbde8d869c8b1c9c44aaabbefd455094e8083ebb

  • SSDEEP

    24576:OKG7SKaZIq3hYiaThGFvIkrlb4yBpssssssss0P0txRwlLcL:mOKK3/a1lkrlb10PGxSKL

Score
10/10
ratdefaultasyncratstormkitty

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • Builder WorldWind Pro.zip
    .zip
  • Builder WorldWind Pro/Builder WorldWind Pro/Builder WorldWind Pro.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Builder WorldWind Pro/Builder WorldWind Pro/DotNetZip.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Builder WorldWind Pro/Builder WorldWind Pro/Extreme.Net.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Builder WorldWind Pro/Builder WorldWind Pro/MetroFramework.Design.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Builder WorldWind Pro/Builder WorldWind Pro/MetroFramework.Fonts.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Builder WorldWind Pro/Builder WorldWind Pro/MetroFramework.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Builder WorldWind Pro/Builder WorldWind Pro/Mono.Cecil.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Builder WorldWind Pro/Builder WorldWind Pro/stub.dll
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections